DNSSEC - Why Network Operators Should Care
And How To Accelerate Deployment
Dan York, CISSP
Senior Content Strategist, Internet Society
Eurasia Network Operators' Group (ENOG) 4
Moscow, Russia
October 23, 2012
www.internetsociety.org/deploy360/
Internet Society Deploy360 Programme
Providing real-world deployment
info for IPv6, DNSSEC and other
Internet technologies:
www.internetsociety.org/deploy360/
www.internetsociety.org/deploy360/
• 
Case Studies
• 
Tutorials
• 
Videos
• 
Whitepapers
• 
News, information
English content, initially, but will
be translated into other
languages.
10/30/12
A Normal DNS Interaction
Web
Server
example.com?
3
https://example.com/
1
Resolver
example.com 10.1.1.123
If not…
4
web page
DNS
Resolver checks its local cache. If it has the
answer, it sends it back.
Web
Browser
2
10.1.1.123
www.internetsociety.org/deploy360/
A Normal DNS Interaction
.com
NS
DNS Svr
root
DNS Svr
.com
example.com
NS
Web
Server
example.com?
5
https://example.com/
1
2
DNS Svr
Resolver
example.com
3
6
web page
DNS
Web
Browser
10.1.1.123
4
10.1.1.123
www.internetsociety.org/deploy360/
DNS works on speed"
"
First result wins"
www.internetsociety.org/deploy360/
Attacking DNS
.com
NS
DNS Svr
root
DNS Svr
.com
example.com
NS
Web
Server
example.com?
5
https://example.com/
1
DNS
2
DNS Svr
Resolver
example.com
10.1.1.123
6
web page
Web
Browser
3
4
192.168.2.2
192.168.2.2
Attacking
DNS Svr
example.com
www.internetsociety.org/deploy360/
A Poisoned Cache
Web
Server
example.com?
3
https://example.com/
1
Resolver
4
web page
Web
Browser
example.com 192.168.2.2
This stays in the cache until the
Time-To-Live (TTL) expires!
2
192.168.2.2
www.internetsociety.org/deploy360/
DNS
Resolver cache now has wrong data:
A DNSSEC Interaction
DNS Svr
root
DNS Svr
.com
Web
Server
example.com?
5
https://example.com/
1
2
DNS Svr
Resolver
example.com
3
6
web page
DNS
Web
Browser
4
10.1.1.123
www.internetsociety.org/deploy360/
10.1.1.123
DNSKEY
RRSIGs
DNS Resolver:"
•  Uses DNSKEY to perform calculation on DNS records"
•  Compares result with RRSIG records"
www.internetsociety.org/deploy360/
Spoof DNSSEC?"
www.internetsociety.org/deploy360/
Delegation Signer (DS) Record"
"
Fingerprint of DNSKEY sent to registry"
www.internetsociety.org/deploy360/
A DNSSEC Interaction
.com
NS
DS
DNS Svr
root
DNS Svr
.com
Web
Server
example.com?
5
https://example.com/
1
DNS
2
DNS Svr
Resolver
example.com
3
6
web page
example.com
NS
DS
Web
Browser
4
10.1.1.123
www.internetsociety.org/deploy360/
10.1.1.123
DNSKEY
RRSIGs
The Global Chain of Trust
.com
NS
DS
DNS Svr
root
DNS Svr
.com
Web
Server
example.com?
5
https://example.com/
1
DNS
2
DNS Svr
Resolver
example.com
3
6
web page
example.com
NS
DS
Web
Browser
4
10.1.1.123
www.internetsociety.org/deploy360/
10.1.1.123
DNSKEY
RRSIGs
Attempting to Spoof DNS
.com
NS
DS
DNS Svr
root
DNS Svr
.com
Web
Server
example.com?
5
https://example.com/
1
example.com
NS
DS
DNS
2
DNS Svr
Resolver
example.com
6
web page
Web
Browser
3
192.168.2.2
DNSKEY
RRSIGs
www.internetsociety.org/deploy360/
10.1.1.123
DNSKEY
RRSIGs
Attacking
DNS Svr
example.com
Attempting to Spoof DNS
.com
NS
DS
DNS Svr
root
DNS Svr
.com
Web
Server
example.com?
5
https://example.com/
1
example.com
NS
DS
DNS
2
DNS Svr
Resolver
example.com
6
web page
Web
Browser
3
4
SERVFAIL
192.168.2.2
DNSKEY
RRSIGs
www.internetsociety.org/deploy360/
10.1.1.123
DNSKEY
RRSIGs
Attacking
DNS Svr
example.com
Integrity of DNS answers"
www.internetsociety.org/deploy360/
Ensuring info entered into DNS is the SAME info end user receives"
www.internetsociety.org/deploy360/
But if I have SSL (TLS), why do I need DNSSEC?"
www.internetsociety.org/deploy360/
The Typical TLS (SSL) Web Interaction
DNS Svr
root
Web
Server
DNS Svr
.com
5
https://example.com/
DNS Svr
6
example.com
TLS-encrypted
web page
2
example.com?
3
1
DNS
Resolver
Web
Browser
4
10.1.1.123
www.internetsociety.org/deploy360/
10.1.1.123
The Typical TLS (SSL) Web Interaction
DNS Svr
root
Web
Server
DNS Svr
.com
5
https://example.com/
DNS Svr
6
example.com
TLS-encrypted
web page
2
example.com?
3
1
Is this encrypted
with the
CORRECT
certificate?
www.internetsociety.org/deploy360/
DNS
Resolver
Web
Browser
4
10.1.1.123
10.1.1.123
What About This?
Web
Server
DNS
Server
https://www.example.com/
www.example.com?
TLS-encrypted web page
with CORRECT certificate
Firewall
(or
attacker)
https://www.example.com/
1
1.2.3.4
2
TLS-encrypted web page
with NEW certificate
(re-signed by firewall)
www.internetsociety.org/deploy360/
Web
Browser
Problems?
Web
Server
DNS
Server
https://www.example.com/
www.example.com?
TLS-encrypted web page
with CORRECT certificate
Firewall
https://www.example.com/
1
1.2.3.4
2
TLS-encrypted web page
with NEW certificate
(re-signed by firewall)
www.internetsociety.org/deploy360/
Web
Browser
Problems?
Web
Server
DNS
Server
https://www.example.com/
www.example.com?
TLS-encrypted web page
with CORRECT certificate
Firewall
https://www.example.com/
1
1.2.3.4
2
Log files
or other
servers
Potentially including
personal information
www.internetsociety.org/deploy360/
TLS-encrypted web page
with NEW certificate
(re-signed by firewall)
Web
Browser
Issues
A Certificate Authority (CA) can sign ANY domain.
Now over 1,500 CAs – there have been compromises
where valid certs were issued for domains.
Middle-boxes such as firewalls can re-sign sessions.
www.internetsociety.org/deploy360/
TLS = encryption + limited integrity protection"
www.internetsociety.org/deploy360/
DNSSEC = strong integrity protection"
www.internetsociety.org/deploy360/
encryption + strong integrity protection?"
www.internetsociety.org/deploy360/
TLS + DNSSEC = DANE!
www.internetsociety.org/deploy360/
DNS-Based Authentication of Named Entities
(DANE)
•  Q: How do you know if the TLS (SSL) certificate is the
correct one the site wants you to use?
•  A: Store the certificate (or fingerprint) in DNS (new TLSA
record) and sign them with DNSSEC.
A browser that understand DNSSEC and DANE will then
know when the required certificate is NOT being used.
Certificate stored in DNS is controlled by the domain name
holder. It could be a certificate signed by a CA – or a selfsigned certificate.
www.internetsociety.org/deploy360/
DANE
Web
Server
TLS-encrypted web page
with CORRECT certificate
Log files
or other
servers
DNS
Server
https://example.com/
Firewall
(or
attacker)
TLS-encrypted web page
with NEW certificate
(re-signed by firewall)
DANE-equipped browser
compares TLS certificate
with what DNS / DNSSEC
says it should be.
www.internetsociety.org/deploy360/
example.com? 2
https://example.com/
1
Web
Browser
w/DANE
10.1.1.123
DNSKEY
RRSIGs
TLSA
DANE – Not Just For The Web
•  DANE defines protocol for storing TLS certificates in DNS
•  Securing Web transactions is the obvious use case
•  Other uses also possible:
•  Email via S/MIME
•  VoIP
•  Jabber/XMPP
•  ?
www.internetsociety.org/deploy360/
10/30/12
DANE Resources
DANE Overview and Resources:
•  http://www.internetsociety.org/deploy360/resources/dane/
IETF Journal article explaining DANE:
•  http://bit.ly/dane-dnssec
RFC 6394 - DANE Use Cases:
•  http://tools.ietf.org/html/rfc6394
RFC 6698 – DANE Protocol:
•  http://tools.ietf.org/html/rfc6698
www.internetsociety.org/deploy360/
Opportunities
•  DANE is just one example of new opportunities brought
about by DNSSEC
•  Developers and others already exploring new ideas
www.internetsociety.org/deploy360/
10/30/12
Getting DNSSEC Deployed
www.internetsociety.org/deploy360/
The Two Parts of DNSSEC
www.internetsociety.org/deploy360/
Signing
Validating
Registries
Applications
Registrars
Enterprises
DNS Hosting
ISPs
Key Questions
•  What needs to be done to get more domains signed with
DNSSEC?
•  How can DNSSEC validation be more widely deployed?
•  Are there technical issues or are the issues more of
communication and awareness?
•  How can we as a community address these challenges to
increase the usage and availability of DNSSEC?
www.internetsociety.org/deploy360/
Opportunities to Accelerate Deployment
1.  Registrar / DNS hosting provider engagement
• 
Encouraging more registrars to provide DNSSEC and making it easier
for domain name holders.
2.  Validating name servers
• 
Expanding the deployment of DNSSEC-validating name servers at
multiple levels, including ISPs, operating systems and applications.
3.  Enterprise signing of domains
• 
Helping enterprises and other large organizations understand the added
security value they can achieve with DNSSEC, particularly with the new
capabilities of DANE.
4.  Government activity with DNSSEC
• 
Encouraging governments to expand their promotion and usage of
DNSSEC
www.internetsociety.org/deploy360/
Registries / Registrars / DNS Hosting Providers
www.internetsociety.org/deploy360/
DNSSEC Signing - The Individual Steps
Registry
•  Signs TLD
•  Accepts DS records
•  Publishes/signs records
Registrar
•  Accepts DS records
•  Sends DS to registry
•  Provides UI for mgmt
DNS Hosting Provider
•  Signs zones
•  Publishes all records
•  Provides UI for mgmt
Domain Name
Registrant
www.internetsociety.org/deploy360/
•  Enables DNSSEC
(unless automatic)
DNSSEC Signing - The Players
Registries
Registrars
DNS Hosting Providers
Domain Name
Registrants
www.internetsociety.org/deploy360/
Registrar also
provides DNS
hosting services
DNSSEC Signing - The Players
Registries
Registrars
DNS Hosting Providers
Domain Name
Registrants
www.internetsociety.org/deploy360/
Registrant hosts
own DNS
Strong Growth In Signed Domains
Sources: PowerDNS and Verisign Labs
www.internetsociety.org/deploy360/
www.internetsociety.org/deploy360/dnssec/statistics/
Increasing Number of Domain Name Registrars
Need to increase number of
domain name registrars supporting
DNSSEC
•  Good news is that the list keeps
increasing!
List from ICANN at:
•  www.icann.org/en/news/infocus/dnssec/deployment
If you are a registar and support
DNSSEC, you can ask to be
added to ICANN’s list.
Source: www.icann.org/en/news/in-focus/dnssec/deployment
www.internetsociety.org/deploy360/
Validating Name Servers
www.internetsociety.org/deploy360/
Validating Name Servers
•  How do we increase the percentage?
http://validator-search.verisignlabs.com
www.internetsociety.org/deploy360/
Availability of DNSSEC-Validating Resolvers
Consumers need easy availability
of DNSSEC-validating DNS
resolvers. Examples:
•  Comcast in North America
recently rolled out DNSSECvalidating resolvers to 18+ million
customers
•  Almost all ISPs in Sweden and
Czech Republic provide
DNSSEC-validating resolvers
www.internetsociety.org/deploy360/
SURFnet Validating Server Whitepaper
•  New document in August 2012
•  http://bit.ly/sn-dnssec-vali
•  Steps through cost/benefit,
requirements, planning
•  Provides instructions for:
•  BIND 9.x
•  Unbound
•  Windows Server 2012
www.internetsociety.org/deploy360/
10/30/12
Comcast Case Study
•  Presentation at October 2012
DNSSEC Deployment
Workshop at ICANN 45
•  Slides and audio for workshop:
•  toronto45.icann.org/node/34375
•  Comcast presentation:
•  Customer interaction
•  Lessons learned
•  Next steps
www.internetsociety.org/deploy360/
10/30/12
Many DNSSEC Tools Now Available
•  www.internetsociety.org/deploy360/dnssec/tools/
•  www.dnssec-tools.org
www.internetsociety.org/deploy360/
10/30/12
Next Steps
www.internetsociety.org/deploy360/
New Industry Initiative Forming With Focus On:
1.  Deployment Documentation
• 
What do we need in the way of better documentation/tutorials/etc ?
2.  Tools
• 
What are the missing tools?
3.  Unsolved Technical Issues
• 
What technical issues remain that need to be addressed?
4.  Measurement
• 
How do we measure progress of DNSSEC deployment?
• 
Can we get more TLDs, ISPs to help provide statistics?
www.internetsociety.org/deploy360/
Join The Initial Discussions
Public mailing list, “dnssec-coord”, available and open to all:
https://elists.isoc.org/mailman/listinfo/dnssec-coord
Focus is on better coordinating promotion / advocacy /
marketing activities related to DNSSEC deployment.
Planning for monthly conference calls to support online
activities.
Stay tuned for more info… (and join the list!)
www.internetsociety.org/deploy360/
Three Requests For Network Operators
1.  Deploy DNSSEC-validating DNS resolvers
2.  Sign your own domains where possible
3.  Help promote support of DANE protocol
• 
Allow usage of TLSA record. Let browser vendors and others know you
want to use DANE. Help raise awareness of how DANE and DNSSEC
can make the Internet more secure.
www.internetsociety.org/deploy360/
Internet Society Deploy360 Programme
Can You Help Us With:
•  Case Studies?
•  Tutorials?
•  Videos?
How Can We Help You?
www.internetsociety.org/deploy360/
www.internetsociety.org/deploy360/
10/30/12
Dan York, CISSP
Senior Content Strategist, Internet Society
[email protected]
www.internetsociety.org/deploy360/
Thank You!
www.internetsociety.org/deploy360/